chrbb Posted October 23, 2007 Posted October 23, 2007 Finally got new server installed and hopefully end of roaming and mandatory profiles! But ... the only way I can get gpo to work is to deny all access to the local default profile. Is there any other way of getting gpo to overide this profile?
mattx Posted October 23, 2007 Posted October 23, 2007 and hopefully end of roaming and mandatory profiles! :?: I'm confused.
chrbb Posted October 23, 2007 Author Posted October 23, 2007 I'm permanently confused! We had a server set up with mandatory (for pupils) and roaming profiles for staff - got messy with laptops going home and long logons so when new server installed decided to go for gpo, use this at my other school much prefer it. Each computer on the network was orginally set up with a base profile that was then copied across to the default user profile on each computer so that everyone that logged on got the same profile. I'm now finding that this default profile is still overiding the gpo from the server, done gpupdate to no avail, only way to get gpo to work is to deny access to local default profile, and wondered it there was a better way of doing it.
maniac Posted October 23, 2007 Posted October 23, 2007 Does it work on a newly installed machine that hasn't had this default profile loaded onto it?? Mike.
chrbb Posted October 23, 2007 Author Posted October 23, 2007 Yes recently formatted and reinstalled xp - gpo picked up straight away.
maniac Posted October 23, 2007 Posted October 23, 2007 Try this command. secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose it resets all the security settings on a machine back to their origenal default settings. Can take a while to complete, but solves a fair few 'mystery' problems for us. Do use with caution, as I have heard of this causing problems on machines before, but if there's no other suggestions, it may be worth a go. Mike.
richard.thomas Posted October 24, 2007 Posted October 24, 2007 Also try this in a command prompt: gpupdate /force This has solved alot of issues here in terms of pulling GPOs
ajbritton Posted October 24, 2007 Posted October 24, 2007 Sounds like permissions on the profile. Was the profile originally copied using the GUI copy function and permissions changed to allow access to Everyone? See the wiki guide on mandatory profiles for more details.
chrbb Posted October 25, 2007 Author Posted October 25, 2007 AJBritton - yes the computer was set up then the profile was copied across to the default with permissions reset. I've managed to get the gp to be picked up but only by denying everyone access to said default profile, this works but I was wondering if there was a better way to achieve the same result.
ajbritton Posted October 25, 2007 Posted October 25, 2007 AJBritton - yes the computer was set up then the profile was copied across to the default with permissions reset. I've managed to get the gp to be picked up but only by denying everyone access to said default profile, this works but I was wondering if there was a better way to achieve the same result. Hi chrbb You should certainly never have to deny access to the local default profile. Just to confirm (as it's not 100% clear from your post), how did you copy the profile from the source computer. If you dragged/dropped from 'C:\Documents and Settings\username' to the network and then modified the file system ACLs, then this is not sufficient. You must use the 'Copy To...' function from the user profile list in the System Properties dialog box. Have you checked the event logs on the PCs after logging on as a test user?
chrbb Posted October 25, 2007 Author Posted October 25, 2007 I didn't set it up - from what I can remember watching the company that set it up (I'd only just started in the job!) logged on to local pc as new user set up pc as required logged off, logged back on as admin, went to docs and settings copied that users profile to default profile on that computer, set permissions to everyone. They then ghosted that image to all the rest of the computers in the suite. Then to ensure users were set up from the start with a roaming profile that we wanted ie background, printers, proxy etc, they had to log on a computer in the suite their profile was then stored on the server, in a location designated from their user properties. Now on those computers the default profile seems to 'rule the roost' taken priority over the gpo from the server.
benit2 Posted October 25, 2007 Posted October 25, 2007 So, if you use (or going to use) local profiles on each machine - does it drag a new profile down from the server each login? If it does not some programs such as office (if deployed over Lan) install on each user run (it installs some user parts in the profile), where as on one profile for all students you can run this once only. The end result making office products open very quick! Also would you not have thousands of local profiles on each machine? Any work arounds for this? I am on central mand profile for all profiles, login time is about 40 seconds!!
ajbritton Posted October 25, 2007 Posted October 25, 2007 @chrbb, The permissions in a profile cannot simply be changed my modifying the file system ACLs as per your example. When the profile is copied from the source PC to the network, it MUST be copied using the 'Copy To...' function and the permissions modified at that point. This modifies not only the ACLs on the files, but also the ACLs within the registry (within the NTUSER.DAT file). If this is not done, then GP settings cannot be applied because the user trying to load the profile does not have the necessary permissions to write to the registry.
chrbb Posted October 25, 2007 Author Posted October 25, 2007 In my other school gpo only, -we only use class logons not pupils so not huge amount of local stored profiles (primary school) first time class logon office installs then ok. Logon time almost instant, printer installs by logon script and then on subsequent logons just connects to printer. In the school with roaming and mandatory profiles logon time much longer. To be honest the pupil mandatory profiles haven't been a problem it's the roaming ones that have caused issues and now we have wireless in some areas of school the teacher's laptops take forever to logon.
maniac Posted October 25, 2007 Posted October 25, 2007 Still sounds to me like a local security setting of some sort is telling the machines to ignore the mandatory profile, and apply the default one on the machine in it's place. When you deny access to the default profile, it has no choise but to use the mandatory profile. Have you tried running the command I suggested above on a machine yet? It may be worth a go if you havn't. Mike.
chrbb Posted October 25, 2007 Author Posted October 25, 2007 The permissions in a profile cannot simply be changed my modifying the file system ACLs as per your example. When the profile is copied from the source PC to the network, it MUST be copied using the 'Copy To...' function and the permissions modified at that point. This modifies not only the ACLs on the files, but also the ACLs within the registry (within the NTUSER.DAT file). If this is not done, then GP settings cannot be applied because the user trying to load the profile does not have the necessary permissions to write to the registry. So looks like it wasn't set up right then, at the time the company did say something about they'd discovered gpo didn't work with profiles, but I got the distinct impression they considered me too new and female to have any say on the matter. Any suggestions as to what I could do?
maniac Posted October 25, 2007 Posted October 25, 2007 You can open up the user.man file in regedit and set the access permissions manually. This is my prefered method for setting up a mandatory profile, although other methods are perfectly good. Just I was taught to do it this way. Remember to unload it after you're done making changes, else it locks the profile so no one can use it! Mike.
ajbritton Posted October 25, 2007 Posted October 25, 2007 As Maniac says, you can edit the permissions in the user.man file using regedit, but how do you know what they are supposed to be? My understanding is that when you use the 'Copy To...' function to modify the permissions (eg grant permission to Everyone), it does more than just a blanket grant of Full Control to the whole registry hive. Permissions on policy related keys are not the same as permissions elsewhere in the user hive. If I were chrbb, I would want to re-create the profile from scratch.
chrbb Posted October 25, 2007 Author Posted October 25, 2007 Do you mean recreate the default profile for the individual computer from scratch?
maniac Posted October 25, 2007 Posted October 25, 2007 OK little bit confused here, don't think I've fully grasped the concept of how your systems are setup. Can you explain what you had, then what you currently get, then what you're trying to achieve. That way I might have a better idea of what's going on. Sorry! Mike.
chrbb Posted October 25, 2007 Author Posted October 25, 2007 I'm totally confused and it's my network! Right current setup -roaming profiles for staff, mandatory for pupils. A custom default user profile was created on one computer with security set for everyone to read change etc. The other computers were then ghosted from this image. Once users had logged on their copy of this profile was stored on the server. We now have a new server and due to roaming profiles being a pain with teacher's laptops being used offline I want to just use gpo and dispense with the roaming and mandatory profiles. But the default profile on each computer seems to be overiding the gpo settings, I can only get the computer to accept the gp settings if I set security on the computers default profile to deny for everyone
ajbritton Posted October 26, 2007 Posted October 26, 2007 Although I have 'dissed' the idea of using regedit to set the registry permissions in a profile, it might be worth using it to check the registry permissions on network default user profile 1 - On an XP machine, run REGEDIT 2 - Select the HKEY_USERS hive root 3 - Open the File menu and select Load Hive... 4 - Browse to \\(yourservername)\netlogon\Default User 5 - Select NTUSER.DAT and click Open 6 - Enter a name (eg NETDEFUSER) and OK 7 - Open up the HKEY_USERS key 8 - Select the key with the name you entered (eg NETDEFUSER) 9 - Open the Edit menu and select Permissions... 10 - Check and record the configured permissions for each group/user 11 - Click Cancel to close the Permissions dialog box IMPORTANT - Make sure you do the following steps 12 - Ensure the key with the name you entered is still selected 13 - Open the File menu and select Unload Hive... then click Yes 14 - Close regedit Report back with the permissions that you find.
chrbb Posted October 26, 2007 Author Posted October 26, 2007 Thanks - will do that - not in until Mon pm though.
maniac Posted October 26, 2007 Posted October 26, 2007 So your users don't have a roaming profile and don't have a mandatory profile, so therefore they are logged on with just a local profile created from the workstations default profile, and the GPO settings. (Basically the 'profile' line in their AD entry is left blank, correct?) If this is the case, then it could be the ntuser.dat file contained in the local default profile that is causing the problems, more than likely because of permissions within the registry hive rather than the file permissions. So as well as checking the network default profile, I would also check one of the local ones in the same way. Mike.
ajbritton Posted October 26, 2007 Posted October 26, 2007 Good point Maniac. That's definitely worth checking.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now